Configuration Guide User guide

FastIron Configuration Guide 1735
53-1002494-02
Enabling ACL filtering based on VLAN membership or VE port membership
When you bind an IPv4 ACL to a port, the port filters all inbound traffic on the port. However, on a
tagged port, there may be a need to treat packets for one VLAN differently from packets for another
VLAN. In this case, you can configure a tagged port on a Layer 2 device to filter packets based on
the packets’ VLAN membership.
To apply an IPv4 ACL to a specific VLAN on a port, enter commands such as the following.
Brocade(config)#enable ACL-per-port-per-vlan
...
Brocade(config)#vlan 12 name vlan12
Brocade(config-vlan-12)#untag ethernet 5 to 8
Brocade(config-vlan-12)#tag ethernet 23 to 24
Brocade(config-vlan-12)#exit
Brocade(config)#access-list 10 deny host 209.157.22.26 log
Brocade(config)#access-list 10 deny 209.157.29.12 log
Brocade(config)#access-list 10 deny host IPHost1 log
Brocade(config)#access-list 10 permit
Brocade(config)#int e 1/23
Brocade(config-if-e1000-1/23))#per-vlan 12
Brocade(config-if-e1000-1/23-vlan-12))#ip access-group 10 in
NOTE
For FastIron X Series devices, the enable ACL-per-port-per-vlan command must be followed by the
write-memory and reload commands to place the change into effect. .
The commands in this example configure port-based VLAN 12, and add ports e 5 – 8 as untagged
ports and ports e 23 – 24 as tagged ports to the VLAN. The commands following the VLAN
configuration commands configure ACL 10. Finally, the last three commands apply ACL 10 on
VLAN 12 for which port e 23 is a member.
Syntax: per-vlan <VLAN ID>
Syntax: [no] ip access-group <ACL ID>
The <VLAN ID> parameter specifies the VLAN name or number to which you will bind the ACL.
The <ACL ID> parameter is the access list name or number.
Applying an IPv4 ACL to a subset of ports on a virtual
interface (Layer 3 devices only)
NOTE
This section applies to IPv4 ACLs only. IPv6 ACLs do not support ACL filtering based on VE port
membership.
You can apply an IPv4 ACL to a virtual routing interface. The virtual interface is used for routing
between VLANs and contains all the ports within the VLAN. The IPv4 ACL applies to all the ports on
the virtual routing interface. You also can specify a subset of ports within the VLAN containing a
specified virtual interface when assigning an ACL to that virtual interface.
Use this feature when you do not want the IPv4 ACLs to apply to all the ports in the virtual interface
VLAN or when you want to streamline IPv4 ACL performance for the VLAN.